Node.js third-party modules: Prototype pollution attack (lodash)

I would like to report a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype. Module module name: lodash version: 4.17.15 npm page: https://www.npmjs.com/package/lodash Module Description A modern JavaScript utility library delivering...

CVE-2014-0147

CVE-2014-0147 affects QEMU before 1.6.2, where a logic error with signed data types during QCOW2 snapshot creation (impacting QCOW2 and disk image formats used by Bochs) can cause a crash by incorrectly calling update_refcount(). Root cause is a signed data type/logical error in snapshot handling...

CVE-2019-11156

Logic errors in IntelR PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access...

Information disclosure

Logic errors in IntelR PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access...

CVE-2019-11156

Summary: CVE-2019-11156 affects Intel PROSet/Wireless WiFi Software before version 21.40. The issue is described as logic errors that may allow an authenticated, local attacker to escalate privileges, cause a denial of service, and disclose information. Affected software: Intel PROSet/Wireless Wi...

CVE-2019-11156

Logic errors in IntelR PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access...

Remote Code Execution (RCE)

fastjson is vulnerable to Remote Code Execution. The library has code logic errors that allow blacklist check bypass. An attacker is thus able to craft a malicious payload to execute arbitrary code during deserialization...

How to tap the RPC vulnerability, Part 1-the vulnerability warning-the black bar safety net

One, Foreword 2018 Year 8 months late, and one researcher（SandboxEscaper open a Windows local privilege escalation 0day vulnerabilities. On the Internet public after less than two weeks time, the vulnerability has already been malware attacks by using reference ESET articles published in. This...

USN-3415-2: tcpdump vulnerabilities

USN-3415-1 fixed vulnerabilities in tcpdump for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 17.04. This update provides the corresponding tcpdump update for Ubuntu 12.04 ESM. Original advisory details: Wilfried Kirsch discovered a buffer overflow in the SLIP decoder in tcpdump. A remote attack...

USN-3415-1: tcpdump vulnerabilities

Wilfried Kirsch discovered a buffer overflow in the SLIP decoder in tcpdump. A remote attacker could use this to cause a denial of service application crash or possibly execute arbitrary code. CVE-2017-11543 Bhargava Shastry discovered a buffer overflow in the bitfield converter utility function...

Ubuntu: Security Advisory (USN-3415-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : tcpdump vulnerabilities (USN-3415-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3415-1 advisory. Wilfried Kirsch discovered a buffer overflow in the SLIP decoder in tcpdump. A remote attacker could use this to cause a denial of service...

Project Zero Patch Tuesday roundup, November 2014

Posted by Chris Evans, Registrar of Bugs It’s been about a week since Patch Tuesday, and the Project Zero reports mentioned in the various advisories are now public. We won’t always be writing a Patch Tuesday roundup, but we often will when we believe there is a sufficiently varied and interestin...

openSUSE Security Update : samba (openSUSE-SU-2012:0507-1)

" - Add the ldapsmb sources as else patches against them have no chance to apply. - Samba pre-3.6.4 are affected by a vulnerability that allows remote code exe- cution as the 'root' user; PIDL based autogenerated code allows overwriting beyond of allocated array; CVE-2012-1182; bso8815...

International Airlines any user is bound to any phone,any reset a user's password-vulnerability warning-the black bar safety net

In my information point to modify the phone to send the verification code to set up burpsuite cut package Phone=1 5 0&userName=admin Modify your mobile phone number and want to reset the password of the username there is a very magical thing to modify is successful will directly jump to you to...

Adobe Reader < 11.0.1 / 10.1.5 / 9.5.3 Multiple Vulnerabilities (APSB13-02) (Mac OS X)

The version of Adobe Reader installed on the remote Mac OS X host is prior to 11.0.1, 10.1.5, or 9.5.3. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption conditions exist that allow an attacker to execute arbitrary code or cause a denial of service...

Mac OS X : Apple Safari < 6.0.1 Multiple Vulnerabilities

The version of Apple Safari installed on the remote Mac OS X host is earlier than 6.0.1. It is, therefore, potentially affected by several issues : - A logic error in Safari's handling of the Quarantine attribute caused the safe mode not to be triggered on Quarantined files, which could lead to t...

RedHat Update for nss_ldap RHSA-2008:0389-02

Check for the Version of nssldap OpenVAS Vulnerability Test RedHat Update for nssldap RHSA-2008:0389-02 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

The end of the novel System User validation vulnerability-vulnerability warning-the black bar safety net

Vulnerability file:session. asp Program code: if request. cookies"CnendWeb""admininfologinname""" and request. cookies"CnendWeb""admininfologname""" then set rs=server. createobject"adodb. recordset" sql="select from adminuser where username='"&request. cookies"CnendWeb""admininfologname"&"'"...